From dab22dcac0bdf921ca767f6c6e6966dc32c1cfa8 Mon Sep 17 00:00:00 2001
From: Michael Weiser <michael.weiser@gmx.de>
Date: Wed, 31 Jul 2019 15:26:45 +0200
Subject: [PATCH] Add PowerPoint and Publisher to sleep signature whitelist

PowerPoint and Publisher similarly to Word and Excel cause false positives with
the sleep signature. Add them to the exclude list.
---
 modules/signatures/windows/antisandbox_sleep.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/signatures/windows/antisandbox_sleep.py b/modules/signatures/windows/antisandbox_sleep.py
index f7a8d402e..d2ddbde03 100644
--- a/modules/signatures/windows/antisandbox_sleep.py
+++ b/modules/signatures/windows/antisandbox_sleep.py
@@ -32,6 +32,8 @@ class AntiSandboxSleep(Signature):
         "acrord32.exe",
         "winword.exe",
         "excel.exe",
+        "powerpnt.exe",
+        "mspub.exe",
     ]
 
     def init(self):